While validating #12329, repeated pacquet install --lockfile-only runs on the vlt benchmark babylon fixture (87 importers) produced lockfiles that flap between runs of the same binary (reproduced on current main before that PR's changes):

• webpack-dev-server@5.2.2(bufferutil@4.1.0)(utf-8-validate@5.0.10)(webpack-cli@6.0.1)(webpack@5.107.2) vs
• webpack-dev-server@5.2.2(webpack-cli@6.0.1)(webpack@5.107.2)

i.e. whether ws's optional peers (bufferutil, utf-8-validate) propagate into webpack-dev-server's peer suffix varies run to run (~60 diff lines, sometimes both snapshot variants coexist). The resolved package-version set is identical across runs — only the peer-suffix shape differs.

Repro:

git clone --depth 1 https://github.com/vltpkg/benchmarks.git
cd benchmarks/fixtures/babylon
# warm the cache once, then:
for i in 1 2 3; do rm -f pnpm-lock.yaml; pacquet install --lockfile-only; cp pnpm-lock.yaml run$i.yaml; done
diff run1.yaml run2.yaml

Likely in the optional-peer area of resolve_peers (a known divergence area; the supports-color optional-peer gap is documented in the lockfile byte-parity notes). Beyond determinism itself, this makes lockfile-parity testing against pnpm noisy.

Written by an agent (Claude Code, claude-fable-5).